An attacker exploited zkLink’s Arbitrator contract, which failed to clear a previously authenticated message hash after processing a claim. By reusing that hash through the publicly accessible SyncL2TxHashRelayer, the attacker impersonated an authorized gateway message and installed a malicious L2 logs root. The attacker then submitted forged withdrawal proofs against the compromised root to drain approximately $783,100 from zkLink’s Ethereum bridge

The zkLink Nova cross-chain bridge (Ethereum L1 escrow contracts) was exploited. The attacker abused a publicly callable authorized SyncL2TxHashRelayer and a flaw in the Arbitrator contract (failure to clear transient finalizeMessageHash), first populating a valid hash then reusing it to install an attacker-chosen l2LogsRootHashes root under the legitimate gateway identity, enabling withdrawals of ETH and ERC20 assets via forged proofs.